OS Fingerprint

Ping:
By default,
if TTL <= 128, the os is windows.
if TTL <= 64, the os is lunix.

Active detection
nmap:
nmap -O 192.168.1.1
T1: TCP SYN -> 21
T2: TCP NULL -> 21
T3: TCP SYN|FIN|URG|PSH -> 21
T4: TCP ACK -> 21
T5: TCP SYN -> 23
T6: TCP ACK -> 23
T7: TCP FIN|PSH|URG -> 23
PU: UDP -> 1
T1-T4: TCP OPEN T5-T7:TCP CLOSE PU: UDP CLOSE
According to nmap reply and use the result to compare with the nmap database, the os will be revealed.

Passive detection
p0f: running in a server to monitor incoming/outgoing (TCP/UDP/ICMP) packets, establishing the differential database. p0f will help to know what the source OS is.

Network sniffing
Plain text transfer protocol: TELENT, HTTP, FTP, POP3
Linux tools: Sniffit, Tcpdump, Ettercap, Ethereal.
Windows tools: Cain & Abel, Ethereal.

Install Firesheep on Ubuntu 10.04 or 10.10

This morning I had a little bit of free time so I thought I’d (finally) check out the Firefox extension Firesheep. The main website mentions that it isn’t supported for Linux, but the source code is available and as it turns out very easy to compile. Below are instructions for downloading, compiling and installing the Firesheep security plugin for Firefox.

Get the Source

You’ll need to download the source code from github, which can be done using the following two commands:

git clone https://github.com/codebutler/firesheep.git
cd firesheep
git submodule update --init

These two commands will download the code required to compile Firesheep, putting the source into a new directory called “firesheep”.

Build Tools

To compile Firesheep on Ubuntu 10.04 or 10.10 you’ll need the following development packages installed. Simply copy-paste the following list of packages into your terminal:

sudo apt-get install autoconf libtool libpcap-dev libboost-all-dev libhal-dev xulrunner-1.9.2-dev

On my machine this installed quite a few packages, and while the main Firesheep website lists 10.10 specifically, I had no problems on my 10.04 installation.

Build Firesheep

You’re now ready to compile Firesheep. Run the following command and hopefully you’ll be able to build it without error:

./autogen.sh && make

Install the Plugin

If all is well you should find a new file called ‘firesheep.xpi’ in a subdirectory called build (ie; firesheep/build/). Simply drag-and-drop that file into your Addons dialog box, restart Firefox and you should be set.

I’ve been having some issues in actually capturing data on my Dell D630 with an Intel Pro/Wireless 3945ABG card. It looks like this tool is often hardware specific, so your mileage may vary. I’d be interested in anyone offering suggestions on getting it to capture properly on OS X 10.6 (macbook) or Ubuntu 10.04+.

绿雨一气呵成 iPad 3.2.2固件越狱不求人

从来没有像iOS 4.1、iOS 3.2.2越狱这样一波三折——久负盛名的DEV-Team早在一个月前就宣布要放出基于SHAtter漏洞的绿毒（GreenPis0n），并在一周前确认发布时间为2010年10月10日10点10分。可就在发布前夕，神奇小子Geohot突然发力，直接拿出了Limera1n，轻松解决了iPad iOS 3.2.2、iPhone iOS 4.1越狱，让DEV Team被迫推迟绿毒发布。与此同时，Geohot也在不断修正Limera1n程序。截至发稿前，Limera1n最新版本为Beta 4。

在绿雨LimeRa1n发布不久，我们就为大家准备好了苹果iPhone iOS 4.1的越狱教程。接下来当然是要搞定iPad iOS 3.2.2越狱，事实上iOS 3.2.2越狱和iOS 4.1越狱大致相当，只要胆大心细谁都能不求人轻松搞定。

iPad 3.2.2越狱不求人 准备篇

和之前神奇小子Geohot发布的所有越狱工具一样，Limera1n也无需重刷iOS系统。只是相比以往，由于Cydia撞墙，所以完成越狱后我们必须使用VPN或者代理服务器才能成功加载。

与此同时，我们还需要把iTunes升级到最新的iTunes 10版本，并确保iTunes能和iPad正常同步。最后当然是要猛击此处下载最新的Limera1n Beta 4(解压密码：www.evolife.cn)，顺带通过iTunes做好备份。

iPad 3.2.2越狱不求人 实战篇

完成准备功夫之后，自然就开始实战iPad 3.2.2固件越狱了。我们首先确保iPad和iTunes正常连接，关闭所有的杀毒软件防火墙。然后找到下载来解压缩后的limera1n.exe文件，点击右键“以管理员身份运行”。

此时会弹出Limera1n的提示界面。我们点击make it ra1n。iPad就会自动重启进入恢复模式，iTunes也会提示找到一个处于恢复状态的设备。

然后我们根据limera1n提示同时按住Home键和电源键，一直到出现提示“Release Power Button”后保持按住Home键，然后松开电源键大约10秒。此时limera1n就会提示Entering the DFU Mode——此时我们就可以松开所有按键，等待Limera1n自动搞定剩下的工作。

完成上述所有工作后，你的iPad会显示出一个绿色雨滴Logo，随即自动关机——随着屏幕上Limera1n提示Done，iPad 3.2.2/3.2.1固件的越狱就此完成！接下来我们要再度打开iPad，开始安装Cydia和AppSync补丁了！

iPad 3.2.2越狱不求人 安装篇

完成了越狱后，iPad程序中会出现Limera1n图标，由于在国内因为众所周知的原因无法连接到Limera1n网站和Cydia，所以这个图标暂时是白色的。此时我们配置好VPN或者代理服务器，确保可以访问Limera1n.com网站的情况下，点击该白色图标，然后在弹出界面中选择Install Cydia。Limera1n就会开始下载Cydia到你的iPad中。整个过程大约耗时5分钟。

完成下载后，Cydia会自动运行——如果没有，在主界面中运行也没问题。首次运行Cydia，Cydia会自动加载配置程序，完成后自动退出Cydia。我们此时要确保网络、代理服务器或者VPN正常运行，然后慢慢等待Cydia完成配置——整个配置过程大概需要5分钟。

完成配置后，Cydia和Limera1n的图标就不再是一片惨白。我们再点击Cydia运行，Cydia将会提示以什么样的用户身份进行配置。如果不需要命令行，我们点User即可。随后Cydia还会自动进行在线更新，我们强力建议大家不要嫌麻烦，点击Compelety Upgrade，完成所有更新后再进入下一步。更新过程中Cydia还可能重启或自行关闭。

更新完成后我们再度进入Cydia，选择下方的Manage，然后找到Source，点击右上角Add，然后添加一个新源：http://cydia.hackulo.us。注意该源同样需要代理服务器或VPN链接才能正确下载。

完成添加后，在该源提供的软件中找到AppSync for OS 3.2进行安装。然后退出Cydia，重新启动iPad就完成了所有越狱破解动作——此时你安装任何APP都将不受限制。必须注意的是，iPad 3.2.2/3.2.1越狱只能安装AppSync for OS 3.2补丁，除此以外安装其他任何版本的补丁都将直接导致白苹果系统崩溃。

Defend against Firesheep by surfing securely with HTTPS

Defend against Firesheep by surfing securely with HTTPS

by Sebastian Anthony (RSS feed) Oct 27th 2010 at 11:00AM

The last couple of days have seen the launch and explosive proliferation of a Firefox add-on called Firesheep. It's an incredibly simple program that snoops unsecured Wi-Fi packets to grant you one-click masquerading of other users: if you log into Facebook at the local coffee shop, someone can use Firesheep to become you. Seriously, you can go along to any location with an unsecured Wi-Fi network and steal other users' accounts.




Firesheep does this by 'scooping' cookies out of the air. Whenever you log into a website your name and password is only sent once -- afterwards, a stored authorization token is used. This means that if someone has your cookie they can pretend to be you -- and with unsecured wireless networks, anyone can grab your cookie.



This is a huge issue, and you have every right to be concerned -- but there is a solution!



Hopefully you've all heard about SSL and HTTPS, the encryption techniques used to secure Internet communications. The 'secure padlock' icon in your browser is most commonly found when buying things online, but most major sites also use it to secure login and registration. If you see this padlock, you are safe. If you could browse the entire Internet with that secure padlock in place then I wouldn't be writing this post.




Unfortunately, many sites redirect you to an unsecured page after you log in. Yes, your password remains secret -- but what good is that if your exposed cookie can be stolen by anyone on the same unsecured Wi-Fi network?



Fortunately, there are a few solutions for Firefox, and at least one good solution for every other browser.

The key to staying safe is by forcing every connection to use HTTPS, or to go via another connection that encrypts your communication. Almost every website has HTTPS capabilities, but because of the increased overhead that encrypted communication requires, it's often only used for logins and registering. Years ago this might not even have become an issue, but with everyone storing more and more personal information on services like Facebook and Google, and with Wi-Fi blanketing our streets and coffee shops, encryption really is required.

If you use Firefox, these add-ons should do the trick:

• HTTPS Everywhere -- this gem from the Electronic Frontier Foundation is about as good as it gets. By default it forces most popular websites to use HTTPS, and you can add your own rules for other sites. This is one of the few add-ons that I use everywhere


• Torbutton -- this solution is slightly more involved (it's for power-users), but if you want to be really secure and anonymous, the Tor network is a fantastic solution



• Force-TLS -- this is like HTTPS Everywhere, but doesn't come with a built-in dictionary of secure sites. Adding them is very easy, though

Chrome users, due to a limitation of the browser, aren't quite so lucky. There is no way to force HTTPS with an extension. You may have read elsewhere that KB SSL will help you, but it won't. Instead you need to use a secure SOCKS proxy. This isn't particularly hard, it does involve a bit of work.

• A guide for Windows users, using SpoonProxy


• A guide for Mac users, using Meerkat -- our sister site TUAW has a guide that might help, too

Opera and Internet Explorer users: you too will need to use a SOCKS proxy; just follow one of the guides above.




Ultimately, though, if you use unsecured Wi-Fi networks you will leave yourself exposed. The best solution might not be to install add-ons, but to ask your local coffee shop owner to secure his network with WPA2. The entire problem would go away if big-name websites used HTTPS across the board, too.